A preserved archive of the Logical Gamers community forums, 2009-2025. The original threads and posts, served read-only. Registration, posting and private messages are gone for good.

Packet sniffing question

966 views · started by 323 ·
#1
Packet sniffing question
So: I have a packet sniffing question.

I'm sniffing packets on a fairly large network (Hundreds to thousands of computers) and I keep seeing packets that look like this:

Source: Cisco_bf:06:0
Destination: Broadcast
Protocol: ARP
Length: 60
Info: Who has 10.11.x.xx? Tell 10.11.x.x

I x'd out the last few numbers, but you get the point. What is this? Is it scanning for people connected to the network that shouldn't be, or just people connected to the network, or something completely different?

Thanks.

Edit, found this: Bidirectional Forwarding Detection for EIGRP [IP Routing] - Cisco Systems

Could it be that? Bidirectional forwarding? From what I skimmed from that article, is the network checking its own integrity?
#3
Kain wrote:


So, should I be looking at the duplicate address detecting thing? I'm almost positive that's what it is. Is that any type of IDS that I would have to worry about, or is it just a routine check?